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DETAILED ACTION 
Response to Amendment 

1. This action is in response to the amendment filed 10/16/2007. Claims 
1-6, 8-13 and 15-19 have been amended; claims 7 and 14 have been 
cancelled. 



Response to Arguments 

2. Applicant's arguments filed 10/16/2007 have been fully considered but 
they are not persuasive. 

Applicant argues that Leser (2005/0028006) requires a user to 
perform a specific, explicit action to change the state of the process-driven 
security policy (i.e., to transfer a data object to a new control policy), and, 
therefore, Leser does not teach or suggest the use of an event to change the 
state of the process-driven security policy, wherein the changed state is 
based on a transition rule associated with the event as recited in claim 1 
(page 10, second paragraph). Since the claim does not recite what kind of 
event used to change the state of the process-driven security policy, the 
action performed by the user is an event (i.e., a thing that happens or takes 
place). Leser discloses changing the state of the process-driven security 
policy for the electronic document automatically based on an event (i.e., the 
Director of Research transfers the document to the VP Compliance and 
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activates the Review policy), wherein the changed state Is based on a 
transition rule associated with the event (i.e., document research -> 
document review -> document publishing) (figure 1; figures 2-3, step 7; fig. 
5, step 12). 

Applicant argues that Downs (6,226,618) does not disclose a process- 
driven security policy as defined in paragraph [0035] of the publication of 
the instant application (page 14, third paragraph). However, Applicant does 
not provide a definition of a process-driven security policy In paragraph 
[0035]. Therefore, a broad and reasonable interpretation of a process- 
driven security policy reads on Downs license which indicates a number of 
times content can be played (I.e., the process of playing the content causes 
a change in the state of the license: the number of times the content can be 
played Is updated). 

In response to applicant's argument that Downs falls to disclose 
changing any state of a document (page 15, first paragraph), it is noted that 
the features upon which applicant relies is not recited in the rejected 
clalm(s). Although the claims are interpreted In light of the specification, 
limitations from the specification are not read Into the claims. See In re Van 
Geuns, 988 F.2d 1181, 26 USPQ2d 1057 (Fed. Cir. 1993). 
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3. Applicant's arguments, see page 13, second paragraph, filed 
10/16/2007, with respect to the rejection of claims 1 and 3-5 under 35 USC 
1.02(e) as being anticipated by Venkatesan (6,801,999) have been fully 
considered and are persuasive. The rejection has been withdrawn: 



Claim Rejections - 35 USC §102 

4. The following is a quotation of the appropriate paragraphs of 35 

U.S.C. 102 that form the basis for the rejections under this section made in 

this Office action: 

A person shall be entitled to a patent unless - 

(b) the invention was patented or described in a printed publication in this or a foreign country 
or in public use or on sale in this country, more than one year prior to the date of application 
for patent in the United States. 

(e) the invention was described in (1) an application for patent, published under section 
122(b), by another filed in the United States before the invention by the applicant for 
patent or (2) a patent granted on an application for patent by another filed in the United 
States before the invention by the applicant for patent, except that an international 
application filed under the treaty defined In section 351(a) shall have the effects for 
purposes of this subsection of an application filed in the United States only if the 
international application designated the United States and was published under Article 
21(2) of such treaty in the English language. 

5. Claims 1-6, 8-9, 11-13, 15-16 and 18-19 are rejected under 35 
U.S.C. 102(e) as being anticipated by Leser et al. (2005/0028006). 

Regarding claims 1-2, Leser discloses a method comprising: creating a 
process-driven security policy having a plurality of states, with each of the 
states having a different set of access restrictions (figures 1-5; paragraphs 



0096, 0106); associating an identifier to the process-driven security policy. 
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i.e., research/review/publlsli poiicy (fig. 1, element 14; figures 2-5); making 
tlie identifier available to certain of users or groups of users (fig. 15, 
element 124); associating the electronic document with at least one of the 
states of the process-driven security policy to impose access restrictions on 
an electronic document (fig. 6, element 23; fig. 15); and changing the state 
of the process-driven security policy for the electronic document 
automatically based on an event (i.e., the Director of Research transfers the 
document to the VP Compliance and activates the Review policy), wherein 
the changed state is based on a transition rule associated with the event 
(i.e., document research document review -> document publishing) 
(figure 1; figures 2-3, step 7; fig. 5, step 12). 

Regarding claims 3-5, Leser further discloses that the process-driven 
security policy is provided or part of a document security system in which 
the identifier is assigned to a document(s) when the document is created 
(fig. 6, elements 22-23; paragraphs 0146, 0194-0195). 

Regarding claims 6 and 13, Leser discloses a method comprising: 
providing at least one process-driven security policy to a client machine (fig. 
17, steps 140-142), the process-driven security policy having a plurality of 
states associated therewith (fig. 1, elements 14; figures 2-5; paragraph 
0106); associating an electronic document with at least one of the states of 
the process-driven security policy (I.e., associating new document with a 
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security policy having a plurality of states) to impose access restrictions on 
the electronic document, the access restrictions being dependent on the at 
least one of the states of the process-driven security policy (fig. 17, steps 
144-147); and changing the state of the process-driven security policy for 
the electronic document automatically based on an event (i.e., the Director 
of Research transfers the document to the VP Compliance and activates the 
Review policy), wherein the changed state is based on a transition rule 
associated with the event (i.e., document research -> document review 
document publishing) (figure 1; figures 2-3, step 7; fig. 5, step 12). 

Regarding claims 8-9 and 15-16, Leser further discloses that the event 
is a user-triggered event (i.e., the state of the process-driven security policy 
for a document changes when the document is transferred) (fig. 16, step 
136). 

Regarding claims 11 and 18, Leser further discloses that not every 
document is associated with the process-driven security policy (paragraph 
0151). 

Regarding claims 12 and 19, Leser further discloses that a plurality of 
electronic documents are protected by the process-driven security policy 
(paragraphs 0097, 0146). 
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6. Claims 6, 8-13 and 15-19 are rejected under 35 U.S.C. 102(b) as 
being anticipated by Downs et al (6,226,618). 

Regarding claims 6, 11, 13 and 18, Downs discloses a method 
comprising: providing at least one process-driven security policy from a 
server machine to a client machine, the process-driven security policy 
having a plurality of states associated therewith (i.e., a license indicating a 
content can be accessed a certain number of times) (col. 6, lines 36-67; col. 
1, lines 1-10, lines 41-65; col. 10, lines 60-63; col. 21, lines 43-63; col. 59, 
lines 7-66); associating an electronic document with at least one of the 
states of the process-driven security policy to impose access restrictions on 
an electronic document, the access restrictions being dependent on the at 
least one of the states of the process-driven security policy (i.e., embedding 
usage conditions in the content for controlling access to content) (col. 59, 
lines 7-66; col. 63, line 61 - col. 64, line 34; col. 82, lines 6-22); and 
subsequently changing the state of the process-driven security policy for the 
electronic document automatically based on an event, wherein the changed 
state is based on a transition rule associated with the event (i.e., the 
process of playing the content causes a change in the state of the license: 
the number of times the content can be played is updated) (col. 7, lines 41- 
65; col. 21, lines 43-63; col. 59, lines 7-66). 
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Regarding claims 8-9 and 15-16, Downs further discloses that the 
event is a user-triggered event (i.e., the state of the process-driven security 
policy for a content changes when the content is played) (col. 7, lines 41-65; 
col. 21, lines 43-63; col. 59, lines 7-66). 

Regarding claims 10 and 17, Downs further discloses that the content 
includes security information, which includes at least an indication of the 
state of the process-driven security policy for the content (col. 82, lines 6- 
22). 

Regarding claims 12 and 19, Downs further discloses that the content 
is an album containing multiple songs (col. 52, lines 59-64). 



Claim Rejections - 35 USC §103 

7. The following is a quotation of 35 U.S.C. 103(a) which forms the basis 
for all obviousness rejections set forth in this Office action: 

. (a) A patent may not be obtained though the invention is not identically disclosed or 
described as set forth in section 102 of this title, if the differences between the subject 
matter sought to be patented and the prior art are such that the subject matter as a 
whole would have been obvious at the time the invention was made to a person having 
ordinary skill in the art to which said subject matter pertains. Patentability shall not be 
negatived by the manner In which the invention was made. 

8. Claims 10 and 17 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Leser as applied to claims 6 and 13 above, and further in 
view of Martin et al. (2003/0217264). Leser does not disclose that the 
electronic document includes security information, and the security 
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information includes an indication of tlie state of the process-driven security 
policy for the electronic document. Martin discloses a method and system 
for protecting electronic document using a process-driven security policy, 
i.e., state-based access control policy, wherein the electronic document is 
processed by a user at one state of a workflow and then transferred to 
another user at the next state of the workflow (Abstract; fig. 1, elements 8- 
9; paragraph 0015). Martin further discloses that the electronic document 
includes a signature of the document signed by the user at each state before 
the signed document is transferred to the next state (fig. 4, steps 70-72; 
paragraph 0022). It would have been obvious to one of ordinary In the art 
at the time the invention was made to modify Leser method such that the 
electronic document includes a signature of the document signed by the user 
at each state before the signed document is transferred to the next state, as 
taught by Martin. Using the signature, the user at the next state would be 
able to verify that the electronic document had not been altered from the 
time the user at the previous state signed the electronic document 
(paragraph 0022). 

Double Patenting 

9. The nonstatutory double patenting rejection is based on a judicially 
created doctrine grounded in public policy (a policy reflected in the statute) 
so as to prevent the unjustified or improper timewise extension of the "right 
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to exclude" granted by a patent and to prevent possible harassment by 
multiple assignees. A nonstatutory obviousness-type double patenting 
rejection is appropriate wliere tiie conflicting claims are not identical, but at 
least one examined application claim is not patentably distinct from tlie 
reference claim(s) because the examined application claim is either 
anticipated by, or would have been obvious over, the reference claim(s). 
See, e.g.. In re Berg, 140 F.3d 1428, 46 USPQ2d 1226 (Fed. Cir. 1998); In 
re Goodman, 11 F.3d 1046, 29 USPQ2d 2010 (Fed. Cir. 1993); In re Longi, 
759 F.2d 887, 225 USPQ 645 (Fed. Cir. 1985); In re Van Ornum, 686 F.2d 
937, 214 USPQ 761 (CCPA 1982); In re Voge I, 422 F.2d 438, 164 USPQ 619 
(CCPA 1970); and In re Thorington, 418 F.2d 528, 163 USPQ 644 (CCPA 
1969). 

A timely filed terminal disclaimer in compliance with 37 CFR 1.321(c) 
or 1.321(d) may be used to overcome an actual or provisional rejection 
based on a nonstatutory double patenting ground provided the conflicting 
application or patent either is shown to be commonly owned with this 
application, or claims an invention made as a result of activities undertaken 
within the scope of a joint research agreement. 

Effective January 1, 1994, a registered attorney or agent of record 
may sign a terminal disclaimer. A terminal disclaimer signed by the assignee 
must fully comply with 37 CFR 3.73(b). 

10. Claims 6, 12-13 and 19 are provisionally rejected on the ground of 
nonstatutory obviousness-type double patenting as being unpatentable over 
claims 21-22, 24 and 28 of copending Application No. 10/676474. Although 
the conflicting claims are not identical, they are not patentably distinct from 
each other because, with one exception, all of the limitations in the instant 
claims are present In the corresponding claims of Application '474. The one 
exception is that whereas the instant claims use a process-driven security 
policy, the '474 claims use a reference to the process-driven security policy, 
However, having a reference to an object (e.g., a pointer, link, URL, etc.) is 
functionally equivalent to having the object itself. Therefore, using a 
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reference to an object is an obvious variation of using tlie object itself, and 
is not a patentable difference between the two set of claims. 

This is a provisional obviousness-type double patenting rejection 
because the conflicting claims have not In fact been patented. 

Conclusion 

11. The prior art made of record and not relied upon is considered 
pertinent to applicant's disclosure. 

U.S. Patent No. 7,308,702 to Thomsen et al. 

Botha et al., Access Control In Document-Centric Workflow Systems - 
An Agent- Based Approach" 

12. THIS ACTION IS MADE FINAL. Applicant is reminded of the 
extension of time policy as set forth in 37 CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to 
expire THREE MONTHS from the mailing date of this action. In the event a 
first reply is filed within TWO MONTHS of the mailing date of this final action 
and the advisory action is not mailed until after the end of the THREE- 
MONTH shortened statutory period, then the shortened statutory period will 
expire on the date the advisory action is mailed, and any extension fee 
pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the 
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advisory action. In no event, fiowever, will the statutory period for reply 
expire later than SIX MONTHS from the mailing date of this final action. 

Any inquiry concerning this communication or earlier communications 
from the examiner should be directed to MInh Dinh whose telephone number 
is 571-272-3802. The examiner can normally be reached on Mon-Frl: 
10:00am-6:30pm. 

If attempts to reach the examiner by telephone are unsuccessful, the 
examiner's supervisor, Gilberto Barron can be reached on 571-272-3799. 
The fax phone number for the organization where this application or 
proceeding is assigned Is 571-273-8300. 

Information regarding the status of an application may be obtained 
from the Patent Application Information Retrieval (PAIR) system. Status 
information for published applications may be obtained from either Private 
PAIR or Public PAIR. Status information for unpublished applications Is 
available through Private PAIR only. For more information about the PAIR 
system, see http://palr-dlrect.uspto.gov. Should you have questions on 
access to the Private PAIR system, contact the Electronic Business Center 
(EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated 
information system, call 800-786-9199 (IN USA OR CANADA) or 571-272- 
1000. 
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